Re: Mozilla Cloud non-Decryptable Download?

[email protected] Fri, 27 Nov 2015 12:46:39 +0100
Newsgroups	gmane.comp.mozilla.security
Message-ID	<20151127114639.GA23259@g0n>
Hi!

The concrete 70M non-decryptable from the previous topic (on Gentoo
Forums, and in this same thread here) I have not yet solved.

Because I have more urgent issues in my use of Firefox, and because of
the turtle-speed of my progress in learning this knowhow.

On 151101-21:54+0100, [email protected] wrote:
> Hi!
> 
> This looks precious to me. Feels right away as the honest advice:
> 
> On 151101-15:27-0500, Andrew Sutherland wrote:
> > On Sun, Nov 1, 2015, at 07:22 AM, [email protected] wrote:
> > > I'll be greateful for any clues helpful to my decrpyting of that
> > > download.
> > 
> > It's likely a MAR file.  If it is, the file header should start with the
> > magic keyword "MAR1".  See https://wiki.mozilla.org/Software_Update:MAR
> > for more details and a link to a file at the bottom that understands
> > them.
> > 
> > You make reference to a "GET" inside the HTTPS data-stream.  It may be
> > worth manually downloading that URL separately using wget/curl/other and
> > seeing what is extracted from that.  It's possible that in the
> > hexediting you extracted part of the framing around the file, and this
> > would likely help shed light on that.  Alternately, from brief
> > searching, it sounds like wireshark should already be able to save the
> > decompressed content streams from HTTP  via "File -> Export Objects ->
> > HTTP"?
> > 
> > Andrew
> 
...
> Your advice is accepted here with sincere gratitude, but for me to fully
> understand it, it will take time!
>
And by now I have understood the most of the advice above. And thanks
again! (And really sorry that I had to postpone the completion of my
analysis on that 70M non-decryptable.)

But it looks to me other non-decryptables seem to feature in a new
miniature screencast/traffic-dump pair at:

http://www.croatiafidelis.hr/foss/cap/cap-151125-plus-cert/ 

I have tried to very carefully analyze esp. the dump, and, in very
brief, in a matter of a minute or two, I believe an expert can see from
the dump of  617K only:

dump_151125_1447_g0n.pcap

that the "tcp.stream eq 14" filter entered, and decrypted SSL saved (the
dump_151125_1447_g0n_sesskeys.txt, that is the session keys, of course,
previously deployed, which is there to download), the two files, both
 from:

https://tracking-protection.cdn.mozilla.net/mozstd-track-digest256/

and downloading (at least yesterday was such the case) exactly as they
can be gotten as exported objects from the dump, so these were
downloading and are exported as:

total 360
-rw-r--r-- 1 miro miro  54294 2015-10-22 00:07 1445465225
-rw-r--r-- 1 miro miro 307799 2015-11-03 00:37 1446507423
total 360K
-rw-r--r-- 1 miro miro  54K 2015-10-22 00:07 1445465225
-rw-r--r-- 1 miro miro 301K 2015-11-03 00:37 1446507423

It can be seen that they are not MOZ1; again, when SSL decrypted (no
MOZ1 to be found with hexedit).

I have analyzed more in detail (but that is also too extensively
detailed for this list, it's for the forumers there to also understand),
and posted more questions what these files could be, at:

More non-Decryptables (from Mozilla Cloud)
https://forums.gentoo.org/viewtopic-t-1034140.html

where if you read, you can skip the first (for-newbies) post, and skim
only through the second post, if in a hurry:
https://forums.gentoo.org/viewtopic-t-1034140.html#7847334

But in short: if these are legitimate, what are they, and where are they
now in my system.

(Also why any "tracking protection" when I don't have it in my Firefox
settings?)

Thanks if I get info what these two (small really) files exactly are!
-- 
Miroslav Rovis
Zagreb, Croatia
http://www.CroatiaFidelis.hr

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security
signature.asc (application/pgp-signature, 819 B)